[lkml]   [2017]   [Sep]   [5]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
Patch in this message
Subject[PATCH] binder: fix memory corruption in binder_transaction binder
From: Xu YiPing <>

commit 7a4408c6bd3e ("binder: make sure accesses to proc/thread are
safe") made a change to enqueue tcomplete to thread->todo before
enqueuing the transaction. However, in err_dead_proc_or_thread case,
the tcomplete is directly freed, without dequeued. It may cause the
thread->todo list to be corrupted.

So, dequeue it before freeing.

Signed-off-by: Xu YiPing <>
Signed-off-by: Todd Kjos <>
drivers/android/binder.c | 1 +
1 file changed, 1 insertion(+)

diff --git a/drivers/android/binder.c b/drivers/android/binder.c
index d055b3f2a207..96cc28afa383 100644
--- a/drivers/android/binder.c
+++ b/drivers/android/binder.c
@@ -3083,6 +3083,7 @@ static void binder_transaction(struct binder_proc *proc,
return_error = BR_DEAD_REPLY;
return_error_line = __LINE__;
+ binder_dequeue_work(proc, tcomplete);
 \ /
  Last update: 2017-09-05 19:22    [W:0.038 / U:1.856 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site